NSE4 Authentication and VPN Practice Test 6 — 15 Questions

Question 1

A FortiGate admin configures a remote user for SSL VPN tunnel mode. The user can connect but cannot access resources on the internal network. The admin checks the SSL VPN settings: tunnel mode enabled, split tunneling disabled. What is the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall policy from the SSL VPN interface to the internal network is missing or incorrectly configured. When split tunneling is disabled, all traffic from the SSL VPN client is expected to be routed through the FortiGate. However, even with the tunnel established, the FortiGate must have a firewall policy that permits traffic from the SSL VPN interface (e.g., ssl.root) to the internal network interface, with the appropriate source (the user's assigned IP pool) and destination. Without this policy, packets are dropped by the FortiGate's implicit deny rule, preventing access to internal resources.

Answer

The user's FortiClient is outdated

Answer

The SSL certificate is expired

Answer

The user's client software is not configured to route all traffic through the tunnel

Question 2

A FortiGate admin is troubleshooting an IPsec VPN where Phase 1 is up but Phase 2 fails to establish. Which TWO diagnostic commands would provide the most relevant information?

Accepted Answer

diagnose vpn tunnel list. (diagnose vpn tunnel list) is correct because it displays the current state of both Phase 1 and Phase 2 SAs, including any error codes or mismatch details that prevent Phase 2 from establishing. Option E (diagnose vpn ike log) is correct because it enables real-time IKE debugging, showing the exact negotiation steps and failure reasons for Phase 2, such as proxy ID mismatches or proposal mismatches.

Answer

diagnose debug application ike -1

Answer

diagnose netlink interface list

Answer

diagnose sys session list

Question 3

An organization is implementing two-factor authentication for SSL VPN access using FortiToken. Which THREE components are necessary for this setup?

Accepted Answer

A firewall policy that requires authentication and references the user group. A firewall policy must reference the user group that has two-factor authentication enabled. The policy enforces authentication for SSL VPN traffic, and without this reference, the FortiGate would not require the user to authenticate via FortiToken, defeating the purpose of two-factor authentication.

Answer

An LDAP server for user synchronization

Answer

A RADIUS server for token validation

Question 4

A network administrator wants to authenticate VPN users against an existing LDAP server. Which authentication method should be configured on the FortiGate?

Accepted Answer

LDAP. To authenticate VPN users against an existing LDAP server, the FortiGate must be configured to query the LDAP directory directly for user credentials. The LDAP authentication method (option B) allows the FortiGate to bind to the LDAP server using the user's DN and password, verifying identity against the directory. This is the correct choice because the question explicitly specifies an LDAP server, and FortiGate supports native LDAP authentication for SSL/IPsec VPNs without requiring an intermediate RADIUS or FSSO server.

Answer

FSSO

Answer

RADIUS

Answer

Local

Question 5

An administrator configures an IPsec VPN with IKEv1 main mode. The remote peer reports that Phase 1 fails with a 'no proposal chosen' error. The local Phase 1 settings include: encryption AES128, authentication SHA1, DH group 2, lifetime 86400. Which remote peer setting is MOST likely causing the mismatch?

Accepted Answer

Remote peer uses AES256 instead of AES128. In IKEv1 Phase 1, the SA proposal must match on encryption algorithm, authentication hash, DH group, and lifetime. A mismatch in any of these parameters will cause the responder to reject the proposal with 'no proposal chosen'. Therefore, AES256 instead of AES128 (B), DH5 instead of DH2 (C), and SHA256 instead of SHA1 (D) are all plausible causes. There is no basis to designate one as 'most likely' without additional context.

Answer

Remote peer uses aggressive mode

Question 6

You run the following CLI command on a FortiGate: 'diagnose vpn ike config list'. The output includes: 'src 10.0.1.0/24:0 dst 192.168.1.0/24:0'. What does this indicate?

Accepted Answer

The Phase 2 configuration is using 10.0.1.0/24 as local subnet and 192.168.1.0/24 as remote subnet. The 'diagnose vpn ike config list' command displays the Phase 2 configuration for an IPsec VPN tunnel. The output 'src 10.0.1.0/24:0 dst 192.168.1.0/24:0' directly indicates the local and remote subnets defined in the Phase 2 selector, where 'src' is the local subnet and 'dst' is the remote subnet. This confirms that the Phase 2 configuration is using 10.0.1.0/24 as the local subnet and 192.168.1.0/24 as the remote subnet.

Answer

The firewall policy is allowing traffic from 10.0.1.0/24 to 192.168.1.0/24

Answer

The Phase 1 configuration is using 10.0.1.0/24 as local address

Answer

The tunnel is in dial-up mode with dynamic remote subnet

Question 7

An administrator wants to use FortiToken two-factor authentication for SSL VPN users. In addition to configuring the user's FortiToken, which setting must be enabled on the firewall policy to force two-factor authentication?

Accepted Answer

Enable 'Two-factor authentication' on the user group that the policy references. FortiGate enforces two-factor authentication at the user or user-group level, not directly on the firewall policy. When a user is assigned a FortiToken, the 'Two-factor authentication' setting must be enabled on the user group object that the SSL VPN firewall policy references. This tells FortiGate to require both the user's password and a one-time password from the FortiToken before granting access.

Answer

Set the 'auth type' to 'token' on the SSL VPN portal

Answer

Enable 'Two-factor authentication' on the firewall policy

Answer

Configure a FortiToken server object

Question 8

An administrator is troubleshooting an IPsec VPN that fails to establish Phase 2. The Phase 1 is up. The administrator runs 'diagnose vpn ike log' and sees the message 'no matching phase2 proposal found'. What is the MOST likely cause?

Accepted Answer

Phase 2 proxy ID mismatch. The message 'no matching phase2 proposal found' indicates that the IPsec security associations (SAs) proposed by the remote peer do not match the local Phase 2 configuration. Phase 2 uses proxy IDs (local/remote subnets and ports) to define which traffic should be encrypted. A mismatch in these proxy IDs, such as incorrect subnet definitions or protocol/port values, prevents the IKE negotiation from completing Phase 2, even though Phase 1 (which authenticates and establishes the IKE SA) is already up.

Answer

Pre-shared key mismatch

Answer

IKE version mismatch (IKEv1 vs IKEv2)

Answer

Phase 1 encryption algorithm mismatch

Question 9

When configuring a route-based IPsec VPN, which of the following must be created to allow traffic to flow through the tunnel?

Accepted Answer

A static route to the remote subnet via the IPsec interface. In a route-based IPsec VPN, the tunnel is represented as a virtual IPsec interface. To route traffic from the local network to the remote subnet through this tunnel, a static route must be configured with the remote subnet as the destination and the IPsec interface as the next-hop or outgoing interface. Without this route, the FortiGate has no forwarding information to send traffic into the tunnel, even if the IPsec phase 1 and phase 2 settings are correctly established.

Answer

A firewall policy with the VPN interface as source

Answer

A NAT rule to translate the private IPs

Answer

A security profile for VPN traffic

Question 10

An administrator wants to use Fortinet Single Sign-On (FSSO) with Active Directory to transparently authenticate users. Which component is responsible for polling Active Directory for user logon events?

Accepted Answer

FSSO Collector Agent. The FSSO Collector Agent is the component that polls Active Directory domain controllers for security event logs (specifically event ID 4624 for logon events). It then maps these events to user IP addresses and forwards the authentication information to the FortiGate, enabling transparent user identification without requiring client-side software.

Answer

Active Directory Domain Controller

Answer

FortiGate directly with NTLM authentication

Answer

FortiAuthenticator

Question 11

An administrator runs 'diagnose debug application sslvpn -1' on a FortiGate and sees the following output: 'SSLVPN_ERROR:ERR_AUTH_FAIL' for a user. The user is in an LDAP group and has the correct password. What is the MOST likely cause?

Accepted Answer

The user is not a member of the required LDAP group. The error 'ERR_AUTH_FAIL' in the SSL VPN debug output indicates that the authentication request was processed but the user failed an authorization check. Since the user has the correct password, the issue is not with credential validation but with group membership verification. FortiGate SSL VPNs enforce access policies based on group membership; if the user is not a member of the LDAP group specified in the SSL VPN policy, the authentication is rejected at the authorization stage, producing this specific error.

Answer

The SSL VPN certificate is expired

Answer

The LDAP server is unreachable

Answer

The user account is locked out

Question 12

A FortiGate administrator is troubleshooting an IPsec VPN that is dropping traffic intermittently. The administrator runs 'diagnose vpn ike log' and sees many 'DPD' messages. Which THREE conditions could cause frequent DPD (Dead Peer Detection) retransmissions? (Choose three.)

Accepted Answer

High network latency causing DPD timeouts. High network latency can cause DPD packets to exceed the configured timeout interval, triggering retransmissions. DPD relies on timely responses; if the round-trip time (RTT) consistently exceeds the DPD retry interval, the FortiGate will send repeated DPD messages, leading to intermittent traffic drops as the tunnel may be torn down.

Answer

Mismatched IKE version

Answer

Incorrect Phase 2 proxy IDs

Question 13

An administrator is configuring a FortiGate for ZTNA (Zero Trust Network Access). Which TWO components are essential for ZTNA to function? (Choose two.)

Accepted Answer

FortiClient EMS for endpoint compliance. FortiClient EMS is essential for ZTNA because it enforces endpoint compliance by collecting device posture data (e.g., OS version, antivirus status, disk encryption) and communicating this to FortiGate via the FortiTelemetry protocol. Without EMS, the FortiGate cannot verify that endpoints meet security requirements before granting ZTNA access, which is a core principle of Zero Trust.

Answer

A firewall policy with ZTNA tags

Answer

A captive portal

Answer

An IPsec VPN tunnel

Question 14

What is the primary purpose of configuring split tunneling on an SSL VPN?

Accepted Answer

To allow the remote client to access both the corporate network and the Internet simultaneously without routing all traffic through the VPN. Split tunneling on an SSL VPN allows the remote client to have simultaneous access to the corporate network (via the encrypted VPN tunnel) and the public Internet (directly, without going through the VPN). This reduces bandwidth load on the VPN gateway and improves user experience by not routing non-corporate traffic through the encrypted tunnel. Option D correctly describes this behavior.

Answer

To provide two-factor authentication for the VPN connection

Answer

To encrypt all traffic from the remote client, including Internet traffic

Answer

To enable the use of client certificates for authentication

Question 15

A FortiGate administrator configures an SSL VPN web mode portal. Users can access internal web applications but cannot access internal file shares via SMB. What is the most likely reason?

Accepted Answer

Web mode does not support the SMB protocol; users must use tunnel mode to access fileshares. SSL VPN web mode operates as a reverse proxy, translating HTTP/HTTPS traffic only. SMB (Server Message Block) is a non-web protocol that requires direct network-layer connectivity, which web mode cannot provide. Tunnel mode creates a virtual network interface that allows any IP-based protocol, including SMB, to traverse the VPN. Therefore, the correct solution is to use tunnel mode for file share access.

Answer

The SSL VPN policy does not allow SMB traffic

Answer

The fileserver requires client certificates for authentication

Answer

The firewall policy for SSL VPN is configured with the wrong interface